Security Issue While Running Easyapache?

I've noticed a potential security issue while EasyApache is running. During part of the process, visiting a PHP-based website doesn't load the site, but instead downloads the PHP file. Of course that also means that hackers can freely download files like wp-config.php and others.

Has anyone else seen this? It seems to happen for a fairly long time during the process.

Staff Member

Could you open a support ticket using the link in my signature so we can attempt to reproduce the issue on your system and determine why it's happening? Please post the ticket number here so we can update this thread with the outcome.

Staff Member

I've noticed a potential security issue while EasyApache is running. During part of the process, visiting a PHP-based website doesn't load the site, but instead downloads the PHP file. Of course that also means that hackers can freely download files like wp-config.php and others.

Click to expand...

Hello

I've been unable to locate a support ticket for this issue. Were you able to open a support ticket or address the issue through another method? I look forward to your response.

Staff Member

EasyApache restarts Apache with the new build once completed. There shouldn't be any issue with that. Apache restarts for lots of things. Adding a new account for example. If there's enough time to go to your website and download the file(s) from it, you might want to have that server looked at to find out why it's taking so long for Apache to restart.

Opening a ticket to cPanel Technical Support would get to the bottom of the issue far faster than this thread will.

Stop hovering to collapse...Click to collapse...Hover to expand...Click to expand...

So, just as an idea, when EasyApache install starts running, I'd make EA add a directive to httpd.conf so that all *.php files get a temporary 403 Forbidden code. When EA is complete, it would remove this directive. This way end users can't read PHP source code while PHP is being compiled. Feedback is appreciated before I post it as a cPanel/WHM suggestion. There are any number of problems I might not have thought of.

If having an automatic blockage of PHP is a Bad Idea [tm], then it might be interesting to add a button/script under EasyApache "Disable PHP websites from loading on this server." and then display a red warning banner at the top of WHM as long as this feature is turned on.

For now, I plan to STOP the apache service and make sure it stays stopped until PHP is ready. This may be tricky if EA attempts multiple restarts before PHP is ready. This fits in the "experienced server admins wouldn't possibly need this, but WHM/cPanel's target audience might benefit from it" category.

EasyApache restarts Apache with the new build once completed. There shouldn't be any issue with that. Apache restarts for lots of things. Adding a new account for example. If there's enough time to go to your website and download the file(s) from it, you might want to have that server looked at to find out why it's taking so long for Apache to restart.

Opening a ticket to cPanel Technical Support would get to the bottom of the issue far faster than this thread will.

Click to expand...

This. So much this. There should be no reason for .php files to load as source code during the EasyApache process. Apache runs during it and restarts quickly once it's completed. If Apache goes down during the build it's my understanding that it won't restart until the build completes, but if Apache is down then there should be no way for files to be web accessible at all (barring consideration of nginx or custom setups).

During an EasyApache run, Apache stays running in the background, and only restarts once the new Apache binaries have finished building successfully. This ensures that there is 0 downtime during an EA build. If you stop, restart or mess with Apache while EA 3 is building, this will cause your sites to go down and not come back until after the build has completed.